# Monospace Directus


- [CVE-2022-26969](https://insights.sbomify.com/CVE-2022-26969/): Insecure default value for CORS configuration (critical 9.8)
- [CVE-2025-55746](https://insights.sbomify.com/CVE-2025-55746/): Directus allows unauthenticated file upload and file modification due to lacking input sanitization (critical 9.3)
- [CVE-2026-35408](https://insights.sbomify.com/CVE-2026-35408/): Directus is Missing Cross-Origin Opener Policy (high 8.7)
- [CVE-2026-61836](https://insights.sbomify.com/CVE-2026-61836/): Directus: Authorization-dependent response served from unsegmented cache key (high 8.6)
- [CVE-2025-30353](https://insights.sbomify.com/CVE-2025-30353/): Directus's webhook trigger flows can leak sensitive data (high 8.6)
- [CVE-2026-39942](https://insights.sbomify.com/CVE-2026-39942/): Directus has a Path Traversal and Broken Access Control in File Management API (high 8.5)
- [CVE-2024-27295](https://insights.sbomify.com/CVE-2024-27295/): Directus MySQL accent insensitive email matching (high 8.2)
- [CVE-2026-35442](https://insights.sbomify.com/CVE-2026-35442/): Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries (high 8.1)
- [CVE-2026-61835](https://insights.sbomify.com/CVE-2026-61835/): Directus: SSRF Protection Bypass via 0.0.0.0 in File Import (high 7.7)
- [CVE-2026-35409](https://insights.sbomify.com/CVE-2026-35409/): Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import (high 7.7)
- [CVE-2024-54151](https://insights.sbomify.com/CVE-2024-54151/): Directus allows unauthenticated access to WebSocket events and operations (high 7.5)
- [CVE-2024-39896](https://insights.sbomify.com/CVE-2024-39896/): Directus allows SSO User Enumeration (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/products/monospace/directus/